What's changed: Created Professional Cloud DevOps Engineer Chapter 2 (Domain 2 "CI/CD": Cloud Build (CI)/Cloud Deploy (CD; Skaffold/Kustomize)/Artifact Registry/triggers/approval flows; deployment strategies = canary/blue-green/rolling/traffic splitting/feature flags + telemetry success metrics; Cloud Audit Logs/Cloud KMS/Secret Manager/Workload Identity Federation; Artifact Analysis/Binary Authorization/SLSA/environment-based IAM).
2.2Securing the deployment pipeline and managing secrets
Understand auditing/tracking deployments (Artifact Registry, Cloud Build, Cloud Deploy, Cloud Audit Logs), key management (Cloud KMS), secret management (Secret Manager, Workload Identity Federation) with build/runtime injection, Artifact Analysis and vulnerability scanning, software supply-chain security (Binary Authorization, SLSA), and environment-based IAM policies.
The pipeline itself can be a target. Track what, who, and where was deployed, handle secrets safely, and let only trusted artifacts reach production.
2.2.1Auditing, keys, and secret management
Audit/track deployments via Cloud Audit Logs and Artifact Registry/Cloud Build/Cloud Deploy records. Manage encryption keys with Cloud KMS (CMEK) and store API keys/passwords in Secret Manager. When CI/CD needs federated identity from outside/on-prem, authenticate keylessly via Workload Identity Federation. Distinguish build-time injection (do not bake into images) from runtime injection, avoiding hardcoded secrets. Map "store secrets = Secret Manager" and "key management = Cloud KMS."
2.2.2Vulnerability scanning and supply-chain security
Scan images for known issues with vulnerability scanning via Artifact Analysis. To let only verified artifacts reach production, enforce "deploy only signed/attested images" with Binary Authorization. Evaluate and improve end-to-end supply-chain robustness against the SLSA framework levels. Separate access with environment-based IAM policies (tighter for production). Map "block unverified images = Binary Authorization" and "detect vulnerabilities = Artifact Analysis."
Common: requirement → means. E.g., "track who deployed what" = Cloud Audit Logs; "store secrets safely" = Secret Manager; "customer-manage keys" = Cloud KMS; "keyless external identity" = Workload Identity Federation; "scan vulnerabilities" = Artifact Analysis; "only signed images to prod" = Binary Authorization; "supply-chain level" = SLSA.
Watch the mix-ups: (1) Do not bake secrets into images or Git—use Secret Manager + runtime injection. (2) Binary Authorization (enforce deploy gate) vs Artifact Analysis (detect vulnerabilities) play different roles. (3) Separate IAM per environment for prod vs non-prod.
2.2.3Section summary
- Audit deploys via Cloud Audit Logs; keys = Cloud KMS; secrets = Secret Manager; external identity = Workload Identity Federation
- Scan with Artifact Analysis, enforce signed-only to prod with Binary Authorization, assess level with SLSA
- Inject secrets at build/runtime (never hardcode); separate IAM per environment
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To store secrets like API keys/passwords safely and fetch them at runtime, which is best?
Q2. To allow only verified, signed/attested container images to deploy to production, which is best?
Q3. To detect known vulnerabilities in container images, which is best?
Q4. To later track who deployed to which environment and when, which is best?
Q5. To authenticate to Google Cloud from CI/CD using external/on-prem identity without distributing key files, which is best?
Q6. To assess/improve software supply-chain robustness against graduated levels, which framework?